OIG 11G R2 Field Enablement Training

Transcription

1 OIG 11G R2 Field Enablement Training Lab 4 - Configure Request Scenarios Disclaimer: The Virtual Machine Image and other software are provided for use only during the workshop. Please note that you are responsible for deleting them from your computers before you leave. If you would like to try out any of the Oracle products, you may download them from the Oracle Technology Network ( or the Oracle E-Delivery WebSite( 1 P a g e

2 Table of Contents OIG 11G R2 Field Enablement Training... 1 Configure Request Scenarios Introduction Populate Entitlement List and Harvest Entitlements into Catalog Enrich Base Entity Description Harvest definitions into Catalog Customize Catalog Add UDF Enrich Catalog Manual Enrich Catalog Bulk Verify Enriched Data in Catalog Define Security Run the Risk Aggregation Job to Calculate the Risk 9. Simple Request Scenario Advanced request scenario P a g e

3 1. Introduction Sean Ellison is a catalog administrator responsible for managing the catalog. His task is to make sure that it would be easy for end users to search items in the catalog by providing tagging to catalog items so that users can use tags for searching the catalog items. He also would like to provide descriptions for catalog items so that when user looks at the item he can understand what access each item provides for end user. Sean can also add additional fields in the catalog which will help end user understand catalog item as well. Sean will also create categories for catalog items so that when end user searches for catalog items he can filter the items based on the category. The goal here is to make it easy for end user to search & request items from catalog. Joseph Krause is a relatively new employee hired recently in the enterprise and a billable resource in one of the Information Systems Software development projects. He has been asked to start filling in timesheets for the project he is engaged in, so that effort can be tracked overall for calculating billability. He would be using Oracle Identity Center Governance (OIG) self service console to request the relevant access to Timecard application. This access request would be approved by his manager Danny Crane. Once approved, he should be able to see the access provisioned to him and successfully access the timecard application for creating and submitting timesheets. We would also look at advance workflow and approval use cases where the approval task is assigned to multiple users in parallel and any user can claim and approve the request. We would also look at serial approval where more than one approver needs to approve the request. The various approval paths can be designed based on the Item risk of the item being requested. Usually when people join the expense report team, their required access is requested by an expense review department administrator Saundra Mcaulay (SMCAULAY). As Jarvis Galas and Rudy Kuhle have joined the team recently, Saundra will submit their access request, which would be a bunch of entitlements and roles. As some of them would be low risk items, they would be auto-approved and medium risk items would be submitted for parallel approval by either the beneficiaries manager (Danny Crane) or a group of approvers -Audit Review Team. The high risk items would be submitted for serial approval first by beneficiaries manager (Danny Crane) and eventually by Audit Review Team. 3 P a g e

4 2. Populate Entitlement List and Harvest Entitlements into Catalog The purpose of this step is to populate Entitlement List from Lookup definitions and harvest them into Catalog. 1. Login to the Sysadmin console as Admin. 2. Click on Scheduler under System Management. 3. Search for a task by name Entitlement List. 4. Click on the name of the task to open it. 5. Click Run Now. Checkpoint At this point you have populated Entitlement List table (ENT_LIST) and Catalog. 4 P a g e

5 3. Enrich Base Entity Description Lookup Recon via Connectors does not reconcile Description of entitlements. In this section we will add the following and also see How to add description to Application Instance, Role and Entitlement? Manual Go to Application Instance and search for individual entitlement and add description. API Based Use ENT List API to programmatically updated the description in the entitlement. 1. Log in to the Sysadmin as ADMIN. 2. Click on Application Instances under Configuration. 3. Search for an application instance with Display Name as Enterprise Directory OUD. 4. Open Enterprise Directory OUD Application Instance. 5. Navigate to Entitlements tab. 6. You will see all the entitlements of Enterprise Directory OUD Application Instance 7. Search for Create or Edit Timecard Entitlement. You may enter the search string in the box above Display Name column and hit enter to search or sort the Display name column and you will find it right there. 8. Select the entitlement by clicking on that row. 9. Click on Edit from the menu above. 5 P a g e

6 10. Add following description to Entitlement. Display Name Create or Edit Timecard Description Provides access to the Timecard Application for viewing weekly hours 11. Click Save. 12. After successful update Entitlement description will be shown in search result. 13. Repeat above procedure for following entitlements. Display Name Accounting System Integration Policy Definition and Enforcement Policy Expense Type and Bill To Groups View Expense Report Description Provides access to Generate multiple custom-formatted files in an importable format Provides access to work with standard policies or customize to met spending objectives Provides access to assign custom policies, bill to groups, and expense types to individual users Provides access to view the desired expense report to be reviewed 14. Description of Application Instance can be added/edited in the Application Instance Screen. 6 P a g e

7 15. Description for Enterprise Directory OUD is already pre-seeded in the lab. 16. Description of Role can be added/edited in the Role Edit Screen from the Identity Console 17. Description for role Submit Expense Reports is already pre-seeded in the lab. 18. Close all the tabs. Checkpoint At this point you have just populated all entitlements which will be used in the subsequent labs with the business friendly description. 7 P a g e

8 4. Harvest definitions into Catalog This step includes the execution of catalog sync task which will update catalog with updated description of entitlements. 1. Login in Sysadmin console as Admin if not already done. 2. Click on Scheduler under System Management. 3. Search for a task by name Catalog Synchronization Job. 4. Click Run Now. 5. Keep refreshing the job till you see success. 6. Close the popup. 7. Logout and close the browser. Checkpoint At this point you have harvested updated definitions of entitlements into Catalog. 8 P a g e

9 5. Customize Catalog Add UDF These sections include the steps required to add Custom Attribute in the catalog definition and make it display in the UI. There might be a requirement from customer that existing catalog attributes are not sufficient enough to run their business processes. In this case customer might require adding custom attributes in the catalog, populating data into it and using those attributes and data in its business processed. 1. Login into Sysadmin Console as ADMIN. 2. Click on the Sandboxes link. 3. Create sandbox by name Extend-Connector 4. Click on Save and Close. 5. Click OK in confirmation screen. 6. Close Managed Sandboxes tab. 7. Click on Catalog under System Entities. 8. Under Custom section click on Create button to create a new custom field. 9. Choose Text Type attribute. 9 P a g e

10 10. Fill the form with the below details. Display Label Dependent Entity Name DependentEntity ( This will be populated automatically) Description Dependent Entity 11. Click on Save and Close. Attribute is added in the from 12. Close all open tabs Mandatory Step. 13. Click on Sandboxes link at the top of the page. 14. Select Extend-Catalog sandbox. 15. Click Publish sandbox. 16. Click Yes in the warning. 17. Logout of the browser and close it. 18. Login into Identity Console as ADMIN. 19. Click on the Sandboxes link. 20. Create sandbox by name Add-Display. 21. Click OK on confirmation screen. 22. Click on the Catalog on the left hand side to open the Catalog. 23. Search with a string as OUD. 10 P a g e

11 24. Deselect/uncheck Entitlements from the Categories. 25. Select Enterprise Directory OUD by just clicking on the row. 26. Click Customize at the top right of the page. 27. Scroll down to the bottom of the screen. And click on the Information button. It should open the Information screen in a separate window 11 P a g e

12 28. Click on View Source at the top left corner. 29. Now click on the row EnterpriseDirectoryOUD. It will open a warning. Click on Edit. 30. Now on the upper portion in the code click on panelformlayout. Click on Add Content 12 P a g e

13 31. From the Pop up Open the Data Component Catalog 32. Select CartItemsVO1 in the next window and click open. 33. Click Refresh. Mandatory to click on Refresh to get the attribute in the list. 34. Scroll down to find Dependent Entity 35. Click Add. 36. Chose ADF Output Text w/ Label as the option. Catalog display will be updated with the new attribute. 13 P a g e

14 37. Click Close. 38. Observe that the new field has been added 14 P a g e

15 39. Click on the Close on right hand side to come out of customization mode. 40. You can also see that the column Dependent Entity added in the details page. 41. Close all the tabs except the Manage Sandboxes. 42. Click on Sandboxes link at the top. 43. Select the Add-Display sandbox. 44. Click on Publish Sandbox. 45. Choose Yes in the warning. Checkpoint A custom UDF is added in the catalog and the UDF has been added into catalog display through UI Customization. 15 P a g e

16 6. Enrich Catalog Manual This step is required to manually enrich catalog entries. 1. Login into identity console as SELLISON. SELLISON is catalog administrator. 2. Go to Catalog and search for Create or Edit Timecard. 3. Choose Create or Edit Timecard from the search results. Click on the i button to open the catalog item description. This will open a new window 4. Edit the following attributes in the Detailed Information area. Category Timecard Employee Access Audit Objective SOX Risk Level Low Risk User Defined Tags new hire billable 16 P a g e

17 5. Click Apply to save the update. 6. Once the update is successful. You should see a message Catalog item is successfully updated. You can now close the window by clicking on X 7. Repeat above steps to add information for the following entitlements. Name of the Entity Category Audit Objective Risk Level User Defined Tags Policy Definition and Expense Review Team SOX High Expense Review Enforcement Policy Expense Type and Bill To Groups Expense Review Team SOX High Expense Review Accounting System Expense Review Team SOX High Expense Review Integration View Expense Report Expense Review Team SOX Medium Expense Review Submit Expense Reports Expense Submission SOX Low Expense Review Upload Timesheets Timecard Contractors Access SOX Low New Hire Billable 8. Logout. Checkpoint In this step you have just enriched 6 catalog entries manually. This data will be used at the time of searching/requesting catalog items and request workflows in the later labs. 17 P a g e

18 7. Enrich Catalog Bulk This section includes the steps required to update the catalog entries in bulk. 1. Login to the Sysadmin console as ADMIN. 2. Click on Lookups under Configuration. 3. Search for a lookup whose Code value is Lookup.LDAP.Group. 4. Notice the IT Resource Key assigned to the resource. This might be different in your personal environment. NOTE DOWN THIS NUMBER. 5. Click on Cancel. 6. Navigate to the following folder in the VM. /app/dummydata/lab 4 7. Open the CATALOG_METADATA_LOADER_SAMPLE.csv using a text editor (gedit). 8. Change the Field Name DEPENDENT_ENTITY to DEPENDENTENTITY 18 P a g e

19 9. In the file, Change the IT Resource Key accordingly. The default file contains 491 as the key. Replace it with the value you have noted down. 10. Save the file and Close it. 11. Click on Scheduler under System Management. 12. Search for a task by name Catalog Synchronization Job. Click on the name to open. 13. Click Refresh. 14. Make the Updated Date field to be blank. 15. Click Apply. 16. Click Refresh. 17. Update File Path as /app/dummydata/lab 4/CATALOG_METADATA_LOADER_SAMPLE.csv 18. Update Mode as metadata 19. Click on Apply. 20. Click on Run Now. 21. Keeping clicking on Refresh until you see a success message. 22. When you see a success message. Change the Mode to be Incremental 23. Remove the File Path to make It blank as before 24. Click on Apply. 25. Click on Refresh to see if the value is preserve. 26. Close the popup. Checkpoint In this step you have execute Catalog Synchronization Job in metadata mode which has updated 6 entitlements in bulk. 7.1 Verify Enriched Data in Catalog This step will be used to verify the output of bulk load operation done in previous step. 1. Login to the Identity Self Service console as ADMIN. 2. Click on the Catalog icon. 19 P a g e

20 3. Search for Track and Update Ticket for Desktop entitlement. 4. Click on I (information) image to open the catalog details window. You should be able to see the new values populated for different items in the Details Information area. Checkpoint Similarly Verify data for Track and Update ticket for Mobile device, Track and Update ticket for Server, Open ticket for Desktop, Open ticket for Mobile device and Open ticket for Server entitlements. 20 P a g e

21 8. Define Security These steps describe the procedure to publish Application Instance, Entitlements and Roles into Information Systems Organization so that requesters can see these entities in the catalog. 1. Login to the Sysadmin console as ADMIN. 2. Click Application Instances link under Configuration. 3. Search for Enterprise Directory OUD. 4. Open Enterprise Directory OUD Application Instance. 5. Navigate to Organization tab. 6. Click Assign. 7. Search for Information Systems Organization. 8. Select Information Systems organization and click on Add Selected. 9. Ensure that the Hierarchy check box is checked/selected. 10. Select/check Apply to Entitlements. 11. Click OK. Application Instance and Entitlements both are published into Information Systems and its sub organizations. 21 P a g e

22 12. Let s check one entitlement. 13. Click on Entitlements tab and select first entitlement. Because we have selected Apply to Entitlements while publishing Application Instance into the organization, all entitlements of this application instance will automatically be published into the Information Systems organization. 22 P a g e

23 14. Logout and close the Sysadmin console. 15. Login to the Identity Self service console as ADMIN. 16. Navigate to Roles under Administration. 17. Search for OIM Role Submit Expense Reports. 18. Open Role Submit Expense Reports. 19. Navigate to Organizations tab. 20. Click Assign. 21. Search for and select Information Systems organization. 22. Ensure that the Hierarchy checkbox is checked/selected. 23. Click OK. Submit Expense Reports Role is published into Information Systems and its sub organizations. 24. Logout and close the browser. Checkpoint You have published Application Instances, Entitlements and OIM Roles are published into Information Systems so that used can see these entities in subsequent workflow execution steps. 23 P a g e

24 8.1 Run the Risk Aggregation Job to calculate the Risk We have assigned risk level for various entitlements and roles in this lab. We need to run the risk aggregation job so that OIM calculates the risk for each item 1. Login to Sysadmin console as admin/oracle Click on the Scheduler under System Management 3. Search for a scheduled job Risk Aggregation Job 4. Open this schedule job and click Run Now 5. Logout of the sysadmin console. 9. Simple Request Scenario Joseph Krause is a relatively new employee hired recently in the enterprise and a billable resource in one of the Information Systems Software development projects. He has been asked to start filling in timesheets for the project he is engaged in, so that effort can be tracked overall for calculating billability. He would be using Oracle Identity Center Governance (OIG) self service console to request the relevant access to Timecard application. This access request would be approved by his manager Danny Crane. Once approved, he should be able to see the access provisioned to him and successfully access the timecard application for creating and submitting timesheets. Note: If your SOA server is down this exercise will fail. If SOA server is not running please start it. 1. Login to Identity Self Service console as JKRAUSE. 2. Navigate to Catalog. 3. JKRAUSE tries to search the catalog to find the needful access required for a newly hired person who is billable in a project and would want to fill in his timesheets. But he is not sure how to search that access, what are the exact terms by which the needful entities should be looked for. He decided to find the needful based on some natural keyword related to the context, like new hire billable and he gets to see some results. 24 P a g e

25 4. JKRAUSE looks at these items and uses the Categories on the right hand side to decide what he would like to go for. There are two entries, one seems to be relevant for Employees (who can create timecards) and the other one is for contractors (who cannot create timecards but are only allowed to upload spreadsheets containing effort-tracking data). To confirm the access relevant for employees and not contractors, he uncheck the category checkbox for Timecard Contractors Access and is left with only one item to request for. 5. He selects this entry Create or Edit Timecard. 6. Click on Add to Cart. 7. Click on Check Out. 8. Provide the right justification and click on Submit. The request gets submitted and various details related to it are available to be viewed right away. 9. Navigate to the Approval Details tab. It is evident that the request has been assigned to his manager Danny Crane. 10. Open the Thunderbird client in the VM. 25 P a g e

26 11. Click on the inbox for Danny Crane. 12. Danny receives an in his inbox as an approval notification of the request submitted. 13. Logout of Identity Self Service console. 14. Hit the Identity Self Service console. 15. Login as DCRANE. 16. Click on the InBox. It shows the Pending Approvals. 17. Open the request item that is pending. 18. Click on Approve. 19. JKRAUSE receives an in his inbox as soon as the request is approved. This mail is received by the admin account in Thunderbird. 20. Logout as DCRANE. 21. Login to the Identity Self Service as JKRAUSE. 22. Click on Track Requests under Requests. 23. Search and open the latest request. This should now be complete. 24. Navigate to My Access Entitlements. 26 P a g e

27 27 P a g e

28 10. Advanced request scenario Enterprise has a bunch of IT applications and one of them is the expense reporting system, needless to say that it is financially significant. Some of the functionalities offered by this system are very critical to the enterprise from compliance perspective, as to comply with regulatory stds like SOX, necessary controls should be in place to avoid users get fraudulent access. Employees use the system to submit expense reports and their managers approve. But before the amount is finally reimbursed back to them, there is a separate division which reviews all these expense reports very carefully before finally getting them approved for disbursement. They closely watch all the line items to ensure they comply with enterprise s reimbursement policies. This expense review team has a lot of high privileges in the system in terms of reviewing other s reports, approving disbursement, creating accumulated reports for publishing to auditors and so forth. Usually when people join the expense report team, their required access is requested by an expense review department administrator Saundra Mcaulay (SMCAULAY). As Jarvis Galas and Rudy Kuhle have joined the team recently, Saundra will submit their access request, which would be a bunch of entitlements and roles. As some of them would be low risk items, they would be auto-approved and medium risk items would be submitted for parallel approval by either the beneficiaries manager (Danny Crane) or a group of approvers -Audit Review Team. The high risk items would be submitted for serial approval first by beneficiaries manager (Danny Crane) and eventually by Audit Review Team. 1. Login to OIG Self Service console as SMCAULAY. 2. Navigate to the catalog for creating the request for access required by Jarvis and Rudy 3. She goes to the catalog and tries to search using filter expense review She finds 5 results: 1 role of Low risk 1 entitlement of Medium risk 3 entitlement of High risk She could also check/uncheck categories on the right hand side to figure out which items are important from Expense Review team perspective and which are required for simple expense submission. 28 P a g e

29 4. Saundra adds all these 5 items to cart by selecting all the items and click on Add Selected to Cart. 5. Next she needs to remove herself and adds Jarvis and Rudy as beneficiaries. In PS2 the beneficiary screen is also in the same catalog selection screen as well. She needs to click on radio button Others 29 P a g e

30 Now click on + and Search for user JGALAS. Click on Add Selected to add the user Now look for user RKUHLE and Click on Add Selected to add the user 30 P a g e

31 Now click on the Select button to add the selected users You should see the users now selected as beneficiaries Now Click on Checkout. 31 P a g e

32 Click on Submit to submit the request. 6. A Heterogeneous request gets created (and auto-approved) spawning multiple other such child requests. 7. Requests are assigned for Approval. The request approval is assigned as per the logic mentioned in the beginning of the story, MEDIUM RISK item View Expense Report gets assigned for parallel approval, either from the manager (Danny Crane) or the group Audit Review team. 32 P a g e

33 As you can see below its assigned as a parallel approval to either Manager or Audit Review Team Group. This is according to the logic in the SOA composite developed in Lab3. This logic can be changed. Also take a look at the Accounting System Integration. This is a Low Risk Entitlement. So according to the logic in the SOA composite designed in Lab3. This would use a single level manager approval. 33 P a g e

34 Next take a look at the Policy Definition and Enforcement. This is a High Risk Entitlement. According to the rules in the SOA composite designed in Lab3. This would take a serial approval. 34 P a g e

35 8. Danny Crane, manager of Jarvis and Rudy would log on to self service and Approve the requests in his task list. You should also see the s for Danny Crane in thunderbird client in VM. The Thunderbirc Client can be started from the shortcut in the menu 35 P a g e

36 9. Once Danny Crane approves the requests. Based on approvals by Danny Crane, the parallel approvals for the MEDIUM RISK item for both the beneficiaries is DONE. Since either manager or Audit Review team needs to approve the request. The serial approval first stage of the HIGH RISK items requested for both the beneficiaries is now on stage two. As shown below 10. Sally Downs (SDOWNS) is one of the members of Audit Review Team. Login to Identity Console as SDOWNS. She should see the requests pending. She will approve all the requests. 11. As all the approvals are now complete, requestor as well as beneficiaries will see the following s in their inbox 36 P a g e

37 And thereafter, Saundra can pull up the user records of Jarvis and Rudy or they can look at their My Access. Everywhere, it will be clearly seen that both of them have got all the required access which was requested. 37 P a g e

38 Summary The Access Catalog is a centralized collection of access (enterprise roles, application roles, accounts) which has rich and extensible metadata that can be populated and maintained by the customer and which is available throughout request, approval, certification and fulfillment to allow data-driven decisions. End-users interact with the Catalog using the search engine and shopping cart paradigms and use keywords to search for access versus having to know technical jargon. Once the request is submitted, end users can track the request all the way to fulfillment and can be notified every step of the way. Approvers can take action on the approval tasks either from their client or by logging into the Self Service Console. 38 P a g e